SecurityWeek

TeamCity patched CVE-2026-63077, an unauthenticated code execution flaw exploitable via the agent polling protocol.

Ruby on Rails patched a critical unauthenticated flaw allowing arbitrary file reads and potential RCE via Active Storage.

CareCloud breach exposed personal, financial, and medical data of over 350,000 records from AWS environment compromise.

CosmosEscape exposed primary keys for Azure Cosmos DB, granting attackers full read/write access to affected databases.

CISA urges water and wastewater utilities to lock down internet-exposed controllers after intrusions impacted dozens of Minnesota systems.

Frenos secures $1.52M to expand OT security R&D and customer success for industrial control protection.

Critical unauthenticated Fastjson remote code execution is being exploited; update Java libraries and scan for indicators.

Arista's on-prem VeloCloud Orchestrator suffers active command-injection zero-day exploited in the wild; apply vendor patches immediately.

Rockwell fixed code-execution vulnerabilities in Arena simulation software that could be weaponized against industrial organizations.

Origin Energy confirms a breach affecting roughly 2 million customers, with threat actor claiming stolen customer data.

HollowGraph malware uses compromised Microsoft 365 calendars as covert two-way dead-drop C2 channels leveraging Graph API.

Attackers exploited Oracle E-Business Suite zero-day to exfiltrate personal, financial and health information from Este9e Lauder systems.

SecurityWeek announces Critical Impact Awards honoring industrial cybersecurity achievements, winners at ICS Cybersecurity Conference.

ServiceNow AI platform CVE-2026-6875 is being exploited for remote code execution days after disclosure.

Social-engineering attack compromised employee accounts exposing personal and health information at Clover Health Investments.

OpenAI patches AgentForger flaw that allowed creating and remotely controlling invisible AI agents inside organizations.

U.S. agencies warn Iran-linked actors target Siemens, Schneider, and Rockwell ICS devices, detailing PLC compromise techniques impacting OT environments.

A critical SharePoint vulnerability is being exploited in the wild shortly after disclosure, allowing remote authenticated code execution.

Eleven Microsoft-signed legacy UEFI shims can be abused to bypass Secure Boot, undermining platform integrity across devices.